Show HN: NextDNS Adds "Bypass Age Verification"

It's a great idea to get rid of, I'm shocked a company is this brave to do this. It's not in the interest of any adult to upload their ID so the government can track their web browsing. I didn't want to expose my kid to porn when they were 5, somehow it wasn't a problem because the avg browser use was guided by me, but also the browser blocked porn. When they were a bit older, a teenager, I also lightly guided their computer use.

> More and more sites (especially adult ones) are now forcing users to upload IDs or selfies to continue.

> they might just get enough attention from voters to motivate a change

Unfortunately, guaranteeing anonymous internet porno is a terrible political beachhead to motivate "voters" to do anything.

Even if this was a good idea, ID verification technology should not be outsourced to private parties. This is a service governments themselves must provide. I shouldn't need to upload an ID because the government already has it!

If they simply wanted age verification, the dumb and lazy way is to SSO through a government managed portal with OAUTH2 and you only share your age with the third party. You do a one time account setup (you already have to do this in the US for many government services at the federal level) with age verification, that's your gov portal login. This means the government will now which naughty sites you visit of course, but like I said, it is the lazy approach, and if you think about it, if they respect the laws then a law can be passed to prevent them from storing or using that association, if they didn't, they could still sniff your traffic and wiretap you.

A slightly smarter approach would be to directly auth against a government portal and be given a 24h expiring code for age verification, and the government will publish an updated list of codes to trusted businesses. Those codes could be leaked, but making it a felony should deter most cases, because who wants to go to prison to let some kids watch porn?

Smarter people than me can come up with smarter solution, that is really my point. Involving third-parties and requiring you to upload documents is done either out of extreme incompetence or opportunistic malice by elected officials (bribery).

[flagged]

I'm really surprised to see this pop up considering how the NextDNS team seems to have disappeared otherwise. Out of date offerings like you mentioned, coupled with 0 customer support when things break (and things break a lot). New features like this are fine only if the base service works. I can guess that this feature also is going to break soon, and I don't have high hopes for it getting fixed.

I moved over to ControlD about a year ago and I've been very happy. Nothing has broken, and they seem to be active about their service.

+1 to this. I used to use their Samsung blocklist to prevent their shitty ADs being injected into my (pretty-old) tv but it's not been working for at least a couple of years.

Considering this is a post from NextDNS themselves, showing off a NEW and awesome feature.... It doesn't seem abandoned? You don't seem to have even looked at the description lol

I've used nextDNS for years but the past few weeks its been breaking websites left, right and centre so I gave up on it entirely. Everything feels much snappier since I dropped them for a different option too

Just email billing@nextdns.io

NextDNS isn't a content platform required to have age checks, so no, that prohibition doesn't apply here and promoting the bypass feature isn't 'probably illegal'.

That only applies to those platforms that are required to do "highly effective age checks".

i.e. the top category of "harmful" site cannot point people to VPNs as a way to avoid age verification. Everyone else can tell people about VPNs as a way to avoid age verification. The media have been doing so for a start.

> must not host, share or permit content that encourages use of VPNs to get around age checks. The government has also told the BBC it would be illegal for platforms to do so

Holy. Crap. I knew the UK was going off the deep end with these laws, but this actually looks like China-level government reach.

Can VPN/DNS providers independently market their services, if content providers cannot advertise VPN providers?

For people who don't live in the UK, why should they care about UK law?

"Under no circumstances should you use Mullvad VPN (https://mullvad.net/en), available for 5Eur/mo - also payable in Bitcoin, to avoid our age verification checks!"

[flagged]

Same here. I'd previously been using a Pi-Hole and Next is just so much simpler -- especially on the go.

Same. I absolutely love NextDNS.

Yep its my top IT reccomendation to everyone I know

Arguably, the UK's Online Safety Act already allows these products to bypass age verification: see s. 12(6) https://www.legislation.gov.uk/ukpga/2023/50/section/12/6):

> the age verification or age estimation must be of such a kind, and used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child

Unfortunately, it's hard to tell what this passage means, and I suspect it doesn't apply here. (But does that mean there's no law covering age-verification bypassing services? That seems like an unlikely oversight, and the Online Safety Act's badly-drafted enough that I'm not comfortable making a broad assertion here.) Hopefully case law sorts this out a little.

Thanks for answering the one thing I wanted to know about this. It wasn't at all obvious to me how this might be possible using DNS only.

I guess it will work for some sites, but it would be interesting to know what fraction.

> VPN's are great for this. Just install the VPN, have it block access to adult sites, and have it alert me of any suspicious attempts.

> It's bewildering how VPN companies have branded their technology as "anti-censorship" and "privacy-focused." VPN's are a censor's best friend.

You're already using a router. That's where you would normally implement blocks.

A VPN necessarily does the same thing, and so you can implement routing blocks there too. But this is like saying that a virtual machine is a great technology to run software. OK. Why do you want a virtual one?

> There's nothing about connecting to a different network, or using a different DNS provider, that is anti-censorship.

In a sense, it allows you to pick your censors, or no censors. "Anti-censorship" doesn't necessarily mean that nothing is blocked; it means you get to control what's blocked for yourself.

VPNs have nothing to do with it. I guess yours has some kind of filtering service, but that's not at all related to a VPN. It's like buying a V8 engine because you wanted a turbo. V8's can have turbos, but it has nothing to do with being a V8.

Making your own filter choices should not be referred to as "censorship". Censorship is when the choice is taken away.

Same; I switched to ControlD when it appeared NextDNS was on autopilot without support or fixes.

No, I don't think they are proxying traffic. They are giving the website operators a spoofed EDNS Client Subnet which tricks them into thinking the traffic is coming from a different geolocation.

Generally, CDNs, e.g., Akamai, etc., are authoritative DNS providers that direct HTTP traffic to selected reverse proxies

When a customer gives a third party recursive DNS provider, e.g., NextDNS, etc., permission to "block" certain domains then the third party may act as an authoritative nameserver. Queries with RD==1 for A RRs of "blocked" domains not already cached do not need to be forwarded to an authoritative nameserver chosen or operated by the domain owner. The third party can answer these queries with whatever address it chooses, e.g., 0.0.0.0, rewrite the answers, etc.

Whether any third party DNS provider is abusing this permission^1 is not the point of this comment. The point is that delegating DNS to a third party makes it possible^2

1. This could be difficult to discover

2. For example, I have seen DNS caches that return A records for certain domains that do not match the A records returned by the domain's authoritative nameservers; sometimes the responses even falsely claim they are authoritative answers. Academic papers have been published about countries that implement censorship via DNS. Even in the US, it's common for third party DNS providers such as hotels and certain ISPs, including cellular providers, to intercept DNS traffic and direct it to their own caches, rewrite answers, etc. This includes nonrecursive queries to a domain's authoritative nameservers

It likely overrides DNS resolution to CDN/POPs in countries which don't require age checking, or routes the traffic through TCP proxies so your traffic appears to come from a different country without these laws.

This will increase the latency of all traffic to that site though.

I‘m also using the iOS App and I think you need to wait a bit after using the toggle because the DNS requests might be cached by the Browser

Free VPNs are also at the top of the UK App Store. All of them look extremely dodgy, probably ran by foreign adversaries seizing the opportunity to slurp data.

it's all gonna get leaked every quarter

Just to balance the negative comments: I'm in the same boat, I'm paying yearly and I never had to use any support and things also never broke for me.

I've sadly moved away from the service due to it seeming to get a lot slower in recent months. Have moved to a self hosted pihole instance and everything is noticeably faster including most of the apps on my PC.

I’m also a happy customer.

Regarding payments, I pay yearly. At the time I signed up I think it was the only option. They do have a $1.99/month option now, but they still offer yearly pricing.

What? I pay by year

Likewise, unable to get it working myself (tested with reddit and bluesky - both ask for verification still).

Will be keeping an eye on this though, hopefully this can be an alternative to my Irish VPN in the future.

Age verification doesn't protect minors, so I doubt their ethos changed.

I doubt it will. It fits with what I hope is their ethos, which is to allow customers to decide what they want blocked for themselves and their households.

i can see this in the settings page for a profile under the section "Bypass Age Verification"

https://my.nextdns.io/$id/settings

do you care to elaborate or are we being mysterious today?

> If I may ask, what are the dns tricks, is there a blog post about what you added, I am sooo curious about what sorcery is nextdns using.

It is likely they use some form of SNI-based proxy, similar to: https://github.com/celzero/midway

The way this works is, for preset domains, you always answer with the IP of your SNI proxy, which then forwards the connection to the real IP based on the domain in TLS's SNI extension. This "trick" only works for TLS connections that send SNI in the clear, and will not work with QUIC (HTTP/3) or with TLS v1.3 with ECH (encrypted client hello). For non-TLS connections, like cleartext HTTP/2 or HTTP/1, the proxy would look at the Host header. Similar heuristics may exist for other popular cleartext protocols.

ControlD, a similar DNS provider, has supported redirections for a long time now: https://controld.com/features/traffic-redirection

If you own enough public IPs (like a /64 IPv6 or a /22 IPv4), you can vend time-limited unique IP per domain per client IP and support all transport protocols (and not just TLS/HTTP).

I've been using Getflix for years to have my location spoofed to another country. It is a pay product though. I've used it on Amazon and mainly use it for BBC Iplayer. I couldnt ever get netflix to play nice using it or a vpn, so for it I just tunnel to my traffic to a residential address i have in mexico

IIRC there was this service called Tunlr which offered VPN-like location spoofing with similar DNS tricks.

so does it work like this?:

- Client makes a DNS request to ageblockedsite.com using NextDNS server

- NextDNS server returns an IP to a proxy server they control

- Client connects to the site through the proxy server

At least outside of countries that already limit their citizens access to the internet, censorship regulations tend to apply only to providers, not end users, so it would be extremely difficult to go after an extraterritorial VPN provider. In the US, extraterritorial jurisdiction includes not just providers outside of the country, but providers outside of the state. For example, see: https://en.wikipedia.org/wiki/Marquette_National_Bank_of_Min....

The UK age verification seems to be "Upload your ID to a porn site", but that's not the EU solution from what I can tell. What the EU is building is an Identity Wallet, where your national online ID verifies your age with your wallet. The wallet can then tell the sites that yes, this person is in fact 16+ or whatever the age restriction is. How they plan to avoid having kids just borrow their parents phones I don't know, frequent reconfirmation maybe?

The mistake that UK, and probably others, have made is that the government isn't actually able to provide the required infrastructure.

If the solution is anonymous in the sense that the government doesn't see that I visit some site, and the site doesn't see who I am, then I struggle to see problem. This assumes that it's only applied to services and products that are already age restricted in the physical world already.

> Handing over IDs to random sites is definitely a privacy nightmare

They just need to leak all of the elected official internet usage. You'll see this rolled back faster than it was implemented.

I really can't wait for the video titles of the porn our government officials watch to be read out loud by newscasters. That's going to be such sweet karma.

Speak for yourself please.

No one can dictate who can watch something or not.

Porn is just the excuse used to put more systems of control and oppression in place, as can be seen by US and UK conservatives attempting to get the mere existence of trans and LGBT people classified as 'obscene' and thus any mentions of them banned under the same laws.

What would the regime do without people like you?

showing a plastic card in a store to buy the yearly Cum Companion Calendar or whatever is one thing, because the clerk likely is not a savant with eidetic memory, whereas online there's this little thing happening called data processing which starts with the only thing we usually don't want with our ID. copying.

> Paranoia about this is silly.

Having had to deal with some clients with slightly sensitive data, I wish. Photocopies and printed screenshots lying around in the open, CC data copy-pasted manually to other fields or to generic excel sheets because otherwise "it disappears and we can't book late fees" etc. Not even only the "random third-party" companies vetted and specialised in ID verification, but then they get a new support contract down the road, and a fourth- or fifth-party agent who had the cheapest offer now has remote admin access to those desktops.

Probability is low, true. But all it takes is one compromised access.

We all choose our battles probably.

Is it though? Unfortunately this could have been implemented much better with a decentralised approach.

Its not the showing the ID its having it potentially tied to your accounts and usage. Having your ID tied to your selfie which could be leaked.

>Presenting government ID to random entities is literally what government ID's exist for.

Wrong lmao. All forms of Government ID are PII and should be treated as sensitive.

https://www.esafety.gov.au/young-people/protecting-your-iden... Heres basic information from a government looking to enact these same laws.

>Nearly every app, social media platform or website asks you for at least some personally identifiable information. But this data can be stolen or misused. That’s why it’s important to keep it as private and secure as possible. If you have to share it, make sure it’s only used by trusted services with your knowledge and consent.

Wow thats great advice.

Please post a link to a picture of your national ID. /s